Canada is set to move to real-time consumer and business payments as Payments Canada prepares to launch the Real-Time Rail network in 2022, reports Robin Arnfield
The Real-Time Rail is expected to increase the volume of electronic payments in Canada, as it will enable a raft of new services to be introduced by incumbents and new entrants. But, with a heightened fraud risk from irrevocable instant payments, real-time fraud prevention and digital ID verification will need to be built into payment services using the RTR.
The RTR will be operated by Payments Canada, which has a legislative mandate to establish and operate Canada’s core clearing and settlement systems under the Canadian Payments Act.
An always-on infrastructure, the RTR will enable Canadian payment system participants to provide innovative overlay/value-added services including instant P2P transfers, B2B payments, government benefit payments, and social media payments.
Interac: 90% of online transfers
Currently, the main method used by Canadian consumers for online transfers is the Interac e-Transfer service, which is operated by Canadian debit card scheme Interac and used for P2P transfers, bill payments, and B2B payments. Businesses also use Interac e-Transfer, for example for paying suppliers and for bulk disbursements such as payroll. Like PayPal, Interac e-Transfer uses email addresses and cellphone numbers as aliases for bank account numbers.
Interac e-Transfer accounts for 90% of online transfers, with P2P payments services such as PayPal accounting for the remainder. In 2019, online transfers totalled over 540 million transactions representing C$178bn in value, according to Payments Canada’s “Canadian Payments: Methods and Trends: 2020” report. However, online transfers accounted for only 1.8% of the total value and 2.5% of the total volume of Canadian payment transactions including cash and cheques in 2019.
“In the five years to 2019, online transfers grew by 563% in volume and 462.6% in value,” says Cyrielle Chiron, Payments Canada’s Head of Research and Strategic Foresight. “During the same period, Payments Canada observed a significant rise in the total volume and value of electronic payments, accompanied by a widespread shift away from paper-based payment methods.”
Covid-19 has caused a surge in the use of Interac e-Transfer. “Since mid-March 2020, 69% (of survey respondents) report using Interac e-Transfer at least twice a month, up from 42% pre-pandemic,” Interac reports.
Interac e-Transfer is expected to be the first overlay service available on the RTR. “Interac e-Transfer will clear and settle via the RTR, and that will be the single most important change in our ecosystem,” says Andrew McFarlane, Payments Canada’s Executive Director of Modernisation.
A key concern surrounding the launch of real-time payments in Canada is the increased opportunity for fraud, with criminals being able to instantly transfer funds from victims. This concern is justified, since there was a surge in authorised push payment fraud following the launch of the UK’s Faster Payments scheme. As payment transfers occurring via the RTR will take place instantly and will be irrevocable once authorised, banks will have little time for comprehensive fraud monitoring.
When Faster Payments was launched in 2008, UK fraud losses from online banking rose by almost 300% from £22.6m in 2007 to £59.7m in 2009, according to the Deloitte report “Payments modernisation: Balancing the risks and rewards”.
In 2019, members of banking industry association UK Finance reported 122,437 incidents of Authorised Push Payment scams with gross losses of £455.8m.
Payments Canada has established a working group comprising members from all Canada’s banks to address the issue of real-time payments fraud. “Payments Canada’s fraud committee is looking at the right mechanisms and controls which we need to deploy to ensure that the RTR is safe,” says McFarlane. “We’re talking to the UK payments authorities and Australia’s New Payments Platform to see what we can learn from them about fighting fraud.”
Strong customer authentication is one of several security methods that would need to be put in place, McFarlane says. Payments Canada is also looking at introducing a Confirmation of Payee system similar to that offered in the UK.
Although, initially, the RTR will require users to input payees’ bank account numbers, Payments Canada plans to allow overlay payment services to operate on the network using proxy identifiers such as email addresses and cellphone numbers. “While this (use of account aliases) will deliver unprecedented payment flexibility, it also presents a morass of security concerns and increases the potential pool of fraud victims,” the Deloitte report warns.
Currently, many Canadian electronic payments such as mortgages, recurring bill payments, and business invoice payments occur via Payments Canada’s batch-based EFT system, which runs over the Automated Clearing Settlement System (ACSS) and can be revoked. “Cheques are being replaced by EFT payments, particularly in the business world for invoice payments,” said Chiron.
According to Payments Canada, EFT transactions account for the lion’s share of business payments in Canada. In 2018, EFT transactions accounted for 38% of all business payments, compared to 23% for cheques and 7% for online transfers (Interac e-Transfer). “Businesses indicated they used EFT mostly for payroll and payments to the government,” Payments Canada said. “EFT was also commonly used to pay bills such as utilities and for business services.”
In 2019, EFT payments accounted for 51.8% of the total value of payment transactions and 13.4% by volume.
The ACSS handles retail payments such as cheques, direct deposits, bill payments, and Automated Funds Transfer debits and credits.
“Once the RTR is in place, there will be a significant move by consumers for many of the current batch (EFT) payments to move to the RTR, as well as organic growth and supplanting cash,” says “The Rise of Fraud Threats and the Implications of Canadian Payments Modernisation: How Soon is Now?” a report by risk management firm NICE Actimize. “Therefore, large volumes of payments will move from revocable to irrevocable, with significant impact for fraud.”
The RTR is expected to allow higher daily transfer amounts than the C$3,000 daily limit currently offered by Interac e-Transfer. So, as Interac e-Transfer will be one of the overlay services offered on the RTR, this will pose another fraud risk.
“With payments modernisation, daily transaction limits may start at C$10,000 and potentially reach or exceed C$100,000,” the Deloitte report says. “By presenting cybercriminals with more lucrative opportunities for fraud, these higher limits may lead to higher losses.”
Amanda Holden, National Lead for data analytics software vendor SAS Canada’s Fraud and Security Intelligence division, says that Interac e-Transfer currently isn’t real-time. “Although the funds leave the senders account instantly, there is room to reverse the payment if the sender has made a mistake,” she said. “This is because Interac e-Transfer has a multi-day settlement process.”
“With the RTR, clearing and settlement will occur instantly, the transaction limits will be much higher than today, and payments will be irrevocable and non-repudiable,” Holden says. “The answer is to make a real-time fraud risk decision based on data and analytics, that occurs as fast as the payments decision is made. Banks need to use AI and machine-learning in milliseconds to provide a risk score for the transaction, for example detecting a log-on method the customer doesn’t normally use, a transaction they don’t normally perform, or a foreign IP address. If a bank detects a bunch of scams coming from a particular country, it needs to use real-time data and analytics to create rules and adapt models to respond to new attack methods.”
Deloitte recommends that Canadian banks strengthen their payments authentication procedures. “In the UK, two-factor authentication wasn’t sufficient to curb fraud,” the Deloitte report says. “However, the introduction of biometric authentication saw a 24% decrease in malware and remote attacks.”
Introducing digital ID verification for counterparties in payment transactions will help combat real-time payments fraud, says André Boysen, Chief Identity Officer at Canadian digital ID platform provider SecureKey Technologies.
“With the RTR, you’ll need to be sure that the person you’re paying is who they say they are,” he said. “The challenge is that, because we don’t have a digital identity infrastructure, knowing who the counterparty in a transaction is, poses a real problem. So digital IDs can help solve the risk of fraud in P2P and B2B payments.”
In May 2019, SecureKey, in partnership with Canada’s largest banks, launched the Verified.Me blockchain-based federated digital ID platform. Verified.Me uses customer information from banks, telcos, and other companies to validate a customer’s digital ID, enabling them to instantly verify their identity for services such as new bank accounts and credit cards, property rental, utility services, or healthcare.
“We now have 60 organisations which are connected to Verified.Me, including the top Canadian banks,” says Boysen. “Verified.Me is designed to help Canadian prove their identity in multiple types of transactions and also prove the identity of the counterparty in a transaction.”
SecureKey’s Concierge single sign-on authentication system, which uses the same technology as Verified.Me, is used by Canadian FIs to enable their customers to identify themselves when logging into Canadian government websites. Concierge enables Canadians to use their bank or credit union log-in credentials to access e-government services from the Canada Revenue Agency, the country’s tax authority, or Service Canada, which manages pension benefits.
During the pandemic, Concierge saw a surge in usage, and was processing 800 government COVID-19 aid transactions a second, says Boysen.
Since 2016, Payments Canada has been working on an initiative to modernize its legacy wholesale and retail payments infrastructure. This will result in the introduction of new ISO 20022-based high-value settlement (Lynx), batch retail clearing (Settlement Optimisation Engine), and real-time payments (RTR) systems.
The Settlement Optimisation Engine (SOE) will replace the current Automated Clearing Settlement System and the US Dollar Bulk Exchange platforms. Lynx will replace the Large Value Transfer System, which facilitates the transfer of irrevocable payments between Canadian FIs.
In November 2020, Payments Canada selected Mastercard subsidiary Vocalink to provide the clearing and settlement system for the RTR.
The selection of Vocalink, which has provided clearing and settlement systems for real-time payments systems in the UK, the US, the Philippines, and Singapore, followed an extensive procurement process involving the Bank of Canada and the Canadian government’s Department of Finance.
Payments Canada is in the final stages of the vendor procurement process for the RTR’s exchange component, which will enable participating FIs to exchange payments transactions and related messages with each other. RTR participants will be able to connect to the RTR Exchange directly or indirectly through connection service providers to facilitate the exchange of messages with the exchange layer.
The RTR Exchange will be operated by Payments Canada, which envisages that third-party exchanges will also be able to connect to the RTR clearing and settlement system to send and receive clearing and settlement messages.
Third-party exchanges are entities other than Payments Canada, which enable their participants to exchange messages through a proprietary exchange that connects to the RTR. Interac e-Transfer would be one example of a third-party exchange.
The RTR is expected to go live in 2022, following the launch of Lynx in August 2021. Payments Canada has been conducting internal tests of Lynx with its application provider, Italy’s SIA, and its lead technology partner, IBM, and in early 2021 will commence industry testing with Canadian FIs.
“To meet a pressing need for Canadians to receive payment information with each transaction, the RTR will support ISO 20022 right from the start,” said McFarlane. “The work we did on modernisation showed us that it’s critical to have data travelling at high speed with a transaction.”
Vocalink will act as a system integrator, conducting tests, on-boarding all the participating FIs onto the RTR’s clearing and settlement system, and managing the interactions between the exchange layer and the Bank of Canada.
“We’ll bring our global expertise as a multi-rail payments company to bear in the RTR,” says Ramesh Jayakrishnan, Mastercard’s Vice President, New Payment Platforms, Canada. “Our role will be to move the funds from bank A to bank B in the clearing and settling system and to ensure that the liquidity of each of these transactions is guaranteed, so that at no point is there a lack of funds in the system.”
Jayakrishnan said that it isn’t enough just to build a real-time network, because value-added applications need to be overlayed on it. “So, with the right partners in Canada, we hope to build some new use cases for the RTR,” he says.
“As an example, in the US, we’ve launched the Bill Pay Exchange enabling consumers to pay bills in real time over the Clearing House’s real-time network. For the consumer, the ability to pay a bill at the last minute in real time before the due date helps them to manage their finances effectively.”
“What we’ve heard from Canadian banks and the players in the payments ecosystem is that the RTR is the platform for innovation which they have been waiting for,” says McFarlane. “There will be a range of overlay services offered by the key competitors on the RTR.”
McFarlane says that there will be a mix of transactions occurring on the RTR. “Interac e-Transfer will continue to perform very well in the P2P space on the RTR, but we will see a range of use cases emerging for the RTR including corporate and B2B payments,”. “Another possibility would be to enable pre-authorised transfers from consumers’ accounts at one bank to their accounts at another bank to take place on the RTR. These bank transfers currently use our EFT network and take two days. We also plan to introduce Request to Pay services on the RTR, although they won’t be available from day one.”
As envisaged by Payments Canada, Request to Pay will allow businesses and individuals to send an electronic request for a payment, which will be received by the payor, showing the requested amount, due date, and potentially other payments instructions.
“My understanding is that you will get an email containing a payment link and will be given the choice of paying the invoice in full, paying in part, rejecting the invoice, or discussing the invoice with the biller,” says McFarlane.
Payments industry regulatory reforms
Payments Canada’s modernisation initiative is underpinned by several payments industry regulatory reforms, whose purpose is to ensure that incumbents and new entrants can provide innovative, reliable, and secure services.
The Department of Finance has proposed the creation of a Retail Payments Oversight Framework to manage the risks associated with real-time payments. To be overseen by the Bank of Canada, the Framework will provide a risk-based approach to regulating PSPs in order to help facilitate greater participation in, and access to, Canada’s core retail payment systems.
Currently, only deposit-taking FIs can become Payments Canada members and enjoy direct access to its core infrastructure. However, Payments Canada members can act as indirect Automated Clearing Settlement System clearers for non-members.
Widening access for non-bank service providers
As part of its review of the Canadian Payments Act in 2018, the government proposed an associate member class for Payments Canada in order to widen access for non-bank service providers to the ACSS and its replacement the SOE, and also to the RTR.
The government’s February 2019 report on the findings of its consultation, said that, in the case of the ACSS, associate members should be able to directly exchange payment messaging over the ACSS, while clearing and settlement of the actual payments would continue to be undertaken by direct clearers.
“Payments Canada is fully supportive of broader access to payment networks such as the RTR, while ensuring that this is done without compromising safety and security,” says McFarlane. “To ensure broader access, we need two things to happen.
Firstly, the Retail Payments Oversight Framework needs to be in place, and, secondly, the required changes need to be made to the Canadian Payments Act to allow associate membership of Payments Canada. We’re working with the Department of Finance to do this and also with our stakeholders and regulatory partners. Once these two pieces of legislation are enacted, we will have the capability to expand access to the RTR.”
Under the Payments Clearing and Settlement Act, the Bank of Canada has responsibility for the designation and oversight of clearing and settlement systems that have the potential to pose systemic or payments system risk.
“The Bank of Canada has been consulted on the draft legislation that would establish the Canadian Retail Payments Oversight Framework, which the Department of Finance is preparing,” explains Bank of Canada spokesperson Rebecca Spence. “If legislation is approved, the Bank would maintain a public registry of PSPs and supervise PSPs around their operational risk management and end-user fund safeguarding practices. The Bank established the Interim Retail Payments Advisory Committee earlier in 2020 to gather industry expertise about the retail payments services landscape from a number of PSPs.”
The Bank of Canada has designated the ACSS and Interac e-Transfer as prominent payments systems, since disruption or failure of these systems could produce significant adverse effects on Canadian economic activity.
“As the RTR will be introduced as a new system that is expected to clear and settle substantial retail payment volumes, the Bank expects to designate the RTR as a prominent payment system,” says Spence. “Payments Canada is developing the RTR in such a way that it will comply with the Bank’s risk management standards.”